An unauthenticated path traversal vulnerability in Tautulli versions prior to 2.16.0 allows remote attackers to exfiltrate sensitive configuration and database files.

This vulnerability is a path traversal flaw (CWE-27) located in the real_pms_image_proxy endpoint. Unauthenticated attackers can bypass path validation by crafting specific URL parameters to access sensitive files outside the intended directories.

Successful exploitation allows an attacker to retrieve critical files, including the tautulli.db SQLite database and the config.ini file. These files contain sensitive information such as hashed administrative passwords, active JWT tokens, and Plex Media Server authentication tokens, which can lead to full administrative compromise of the application. The CVSS score of 8.6 reflects the high severity of this remote, unauthenticated access.

Immediate Action: Update Tautulli to version 2.16.0 or later immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review application access logs for suspicious requests to the real_pms_image_proxy endpoint, particularly those containing directory traversal sequences such as dot-dot-slash patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests containing path traversal sequences or unauthorized attempts to access sensitive configuration files.

Public Exploit Available: No confirmed public exploit (Metasploit/ExploitDB) is available.

Given the critical nature of the exposed configuration files and the lack of required authentication, this vulnerability presents a significant risk to the integrity and confidentiality of the Tautulli instance. Administrators should prioritize updating to version 2.16.0 as soon as possible to prevent unauthorized access to administrative credentials and tokens.